From: Neil McKee (neil_mckee@inmon.com)
Date: 05/12/03
> Having set up some protocol groups, I am now running into the situation
> where reports show both "TCP.other" and "TCP.Other"
>
> This looks rather strange in the report. I assume this is happening
> because of an interaction between protocolGroups and resultTruncate (I
> have resultTruncate=5 in these reports)
Yes, I see what you mean. "other" is a protocol group classification,
while "Other" means that resultTruncate kicked in. It would perhaps be
better if "other" could just be accumulated into "Other"...as long as
that didn't blur the distinction between TCP.other and UDP.other and
IPv4.other. It's a tricky one that will need some thought!
> I can try to workaround it by increasing the number of protocolGroups,
> so that TCP.other doesn't have much in it. However this is extremely
> error-prone when there are large numbers of clients using services not
> running on well-known ports, using RPC for example...
>
> Any suggestions as to how I can avoid this?
Not at the moment, sorry.
> p.s. According to IANA TCP well-known ports are 0-1023, the default
> configuration has these mapped 1-1024. Should it really be 1-1023?
Yes. 1-1023 is more correct. Thanks for pointing this out.
neil
-- Neil McKee, InMon Corp. tel: +1 (415) 661-6343 http://www.inmon.com
This archive was generated by hypermail 2.1.4 : 05/12/03 PDT